aigroup-workflow 1.3.0 → 2.0.1

package/docs/rules/rust/testing.md

@@ -0,0 +1,154 @@
+---
+paths:
+  - "**/*.rs"
+---
+# Rust Testing
+
+> This file extends [common/testing.md](../common/testing.md) with Rust-specific content.
+
+## Test Framework
+
+- **`#[test]`** with `#[cfg(test)]` modules for unit tests
+- **rstest** for parameterized tests and fixtures
+- **proptest** for property-based testing
+- **mockall** for trait-based mocking
+- **`#[tokio::test]`** for async tests
+
+## Test Organization
+
+```text
+my_crate/
+├── src/
+│   ├── lib.rs           # Unit tests in #[cfg(test)] modules
+│   ├── auth/
+│   │   └── mod.rs       # #[cfg(test)] mod tests { ... }
+│   └── orders/
+│       └── service.rs   # #[cfg(test)] mod tests { ... }
+├── tests/               # Integration tests (each file = separate binary)
+│   ├── api_test.rs
+│   ├── db_test.rs
+│   └── common/          # Shared test utilities
+│       └── mod.rs
+└── benches/             # Criterion benchmarks
+    └── benchmark.rs
+```
+
+Unit tests go inside `#[cfg(test)]` modules in the same file. Integration tests go in `tests/`.
+
+## Unit Test Pattern
+
+```rust
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn creates_user_with_valid_email() {
+        let user = User::new("Alice", "alice@example.com").unwrap();
+        assert_eq!(user.name, "Alice");
+    }
+
+    #[test]
+    fn rejects_invalid_email() {
+        let result = User::new("Bob", "not-an-email");
+        assert!(result.is_err());
+        assert!(result.unwrap_err().to_string().contains("invalid email"));
+    }
+}
+```
+
+## Parameterized Tests
+
+```rust
+use rstest::rstest;
+
+#[rstest]
+#[case("hello", 5)]
+#[case("", 0)]
+#[case("rust", 4)]
+fn test_string_length(#[case] input: &str, #[case] expected: usize) {
+    assert_eq!(input.len(), expected);
+}
+```
+
+## Async Tests
+
+```rust
+#[tokio::test]
+async fn fetches_data_successfully() {
+    let client = TestClient::new().await;
+    let result = client.get("/data").await;
+    assert!(result.is_ok());
+}
+```
+
+## Mocking with mockall
+
+Define traits in production code; generate mocks in test modules:
+
+```rust
+// Production trait — pub so integration tests can import it
+pub trait UserRepository {
+    fn find_by_id(&self, id: u64) -> Option<User>;
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use mockall::predicate::eq;
+
+    mockall::mock! {
+        pub Repo {}
+        impl UserRepository for Repo {
+            fn find_by_id(&self, id: u64) -> Option<User>;
+        }
+    }
+
+    #[test]
+    fn service_returns_user_when_found() {
+        let mut mock = MockRepo::new();
+        mock.expect_find_by_id()
+            .with(eq(42))
+            .times(1)
+            .returning(|_| Some(User { id: 42, name: "Alice".into() }));
+
+        let service = UserService::new(Box::new(mock));
+        let user = service.get_user(42).unwrap();
+        assert_eq!(user.name, "Alice");
+    }
+}
+```
+
+## Test Naming
+
+Use descriptive names that explain the scenario:
+- `creates_user_with_valid_email()`
+- `rejects_order_when_insufficient_stock()`
+- `returns_none_when_not_found()`
+
+## Coverage
+
+- Target 80%+ line coverage
+- Use **cargo-llvm-cov** for coverage reporting
+- Focus on business logic — exclude generated code and FFI bindings
+
+```bash
+cargo llvm-cov                       # Summary
+cargo llvm-cov --html                # HTML report
+cargo llvm-cov --fail-under-lines 80 # Fail if below threshold
+```
+
+## Testing Commands
+
+```bash
+cargo test                       # Run all tests
+cargo test -- --nocapture        # Show println output
+cargo test test_name             # Run tests matching pattern
+cargo test --lib                 # Unit tests only
+cargo test --test api_test       # Specific integration test (tests/api_test.rs)
+cargo test --doc                 # Doc tests only
+```
+
+## References
+
+See skill: `rust-testing` for comprehensive testing patterns including property-based testing, fixtures, and benchmarking with Criterion.

package/docs/rules/security.md

@@ -0,0 +1,73 @@
+# Security
+
+## Mandatory Security Checklist（提交前必过）
+
+- [ ] **无硬编码密钥**（API keys、密码、token、连接串）
+- [ ] **所有用户输入已校验**
+- [ ] **SQL 注入防护**（参数化查询）
+- [ ] **XSS 防护**（HTML 已 sanitize）
+- [ ] **CSRF 保护已启用**
+- [ ] **认证 / 授权已验证**
+- [ ] **限流已就位**（公开端点）
+- [ ] **错误消息不泄露**敏感数据（堆栈、内部路径、SQL 片段）
+
+## Secret Management
+
+- **绝不**硬编码密钥到源码
+- **始终**使用环境变量或 secret manager
+- 启动时校验所需密钥存在
+- 一旦怀疑泄漏，**立即轮换**所有相关密钥
+
+## Auth / Authz 必须独立审查
+
+涉及以下场景的代码**必须**派遣 `security-reviewer`（Codex 用 `reviewer` + security skill）：
+
+- 登录 / 注册 / 密码重置
+- 权限变更、角色升级
+- 支付、退款、积分增减
+- PII（个人身份信息）读写
+- 外部输入边界（API、上传、导入）
+- 加密 / 哈希 / 签名使用
+
+## OWASP Top 10 检查维度
+
+审查时按以下维度过一遍（不是每条都要报，但要都想过）：
+
+1. **A01 Broken Access Control** — 水平/垂直越权、IDOR
+2. **A02 Cryptographic Failures** — 弱算法、弱密钥、`===` 比较密码（用 `timingSafeEqual`）
+3. **A03 Injection** — SQL / NoSQL / 命令 / LDAP / XPath / 模板注入
+4. **A04 Insecure Design** — 缺乏威胁建模
+5. **A05 Security Misconfiguration** — 默认凭据、不必要权限、CORS 过松
+6. **A06 Vulnerable Components** — `npm audit` / `pip-audit` / `bundle audit`
+7. **A07 Auth Failures** — 弱密码策略、会话固定、token 泄漏
+8. **A08 Software and Data Integrity Failures** — 不安全的反序列化、CI/CD 注入
+9. **A09 Logging and Monitoring Failures** — 日志脱敏、异常告警
+10. **A10 SSRF** — 外部 URL 校验
+
+## Security Response Protocol
+
+发现安全问题时：
+
+1. **立即停止**进一步开发
+2. 派遣 `security-reviewer`（Codex 用 `reviewer` + security skill）做深度审计
+3. **先修 CRITICAL**，再继续其他工作
+4. **轮换**任何已暴露的密钥
+5. **全仓搜索**类似问题（同样的反模式可能存在多处）
+
+## 派遣建议
+
+| 信号 | Agent |
+|------|-------|
+| 新增 auth 流程 | `security-reviewer` |
+| 改动支付 / 订单 / 积分 | `security-reviewer` |
+| 加密 / 签名 / token 处理 | `security-reviewer` |
+| 依赖升级（含 transitive） | `code-reviewer`（兼跑 `npm audit`） |
+| 已知 CVE 修复 | `build-error-resolver`（限定最小修复） |
+
+## Verdict 级别
+
+`security-reviewer` 的输出必须给出明确级别：
+
+- **APPROVE** — 无 CRITICAL / HIGH，中低可带 follow-up ticket
+- **REQUEST_CHANGES** — HIGH 必须先修
+- **BLOCK** — CRITICAL 必须先修，不得合并

package/docs/rules/swift/coding-style.md

@@ -0,0 +1,47 @@
+---
+paths:
+  - "**/*.swift"
+  - "**/Package.swift"
+---
+# Swift Coding Style
+
+> This file extends [common/coding-style.md](../common/coding-style.md) with Swift specific content.
+
+## Formatting
+
+- **SwiftFormat** for auto-formatting, **SwiftLint** for style enforcement
+- `swift-format` is bundled with Xcode 16+ as an alternative
+
+## Immutability
+
+- Prefer `let` over `var` — define everything as `let` and only change to `var` if the compiler requires it
+- Use `struct` with value semantics by default; use `class` only when identity or reference semantics are needed
+
+## Naming
+
+Follow [Apple API Design Guidelines](https://www.swift.org/documentation/api-design-guidelines/):
+
+- Clarity at the point of use — omit needless words
+- Name methods and properties for their roles, not their types
+- Use `static let` for constants over global constants
+
+## Error Handling
+
+Use typed throws (Swift 6+) and pattern matching:
+
+```swift
+func load(id: String) throws(LoadError) -> Item {
+    guard let data = try? read(from: path) else {
+        throw .fileNotFound(id)
+    }
+    return try decode(data)
+}
+```
+
+## Concurrency
+
+Enable Swift 6 strict concurrency checking. Prefer:
+
+- `Sendable` value types for data crossing isolation boundaries
+- Actors for shared mutable state
+- Structured concurrency (`async let`, `TaskGroup`) over unstructured `Task {}`

package/docs/rules/swift/hooks.md

@@ -0,0 +1,20 @@
+---
+paths:
+  - "**/*.swift"
+  - "**/Package.swift"
+---
+# Swift Hooks
+
+> This file extends [common/hooks.md](../common/hooks.md) with Swift specific content.
+
+## PostToolUse Hooks
+
+Configure in `~/.claude/settings.json`:
+
+- **SwiftFormat**: Auto-format `.swift` files after edit
+- **SwiftLint**: Run lint checks after editing `.swift` files
+- **swift build**: Type-check modified packages after edit
+
+## Warning
+
+Flag `print()` statements — use `os.Logger` or structured logging instead for production code.

package/docs/rules/swift/patterns.md

@@ -0,0 +1,66 @@
+---
+paths:
+  - "**/*.swift"
+  - "**/Package.swift"
+---
+# Swift Patterns
+
+> This file extends [common/patterns.md](../common/patterns.md) with Swift specific content.
+
+## Protocol-Oriented Design
+
+Define small, focused protocols. Use protocol extensions for shared defaults:
+
+```swift
+protocol Repository: Sendable {
+    associatedtype Item: Identifiable & Sendable
+    func find(by id: Item.ID) async throws -> Item?
+    func save(_ item: Item) async throws
+}
+```
+
+## Value Types
+
+- Use structs for data transfer objects and models
+- Use enums with associated values to model distinct states:
+
+```swift
+enum LoadState<T: Sendable>: Sendable {
+    case idle
+    case loading
+    case loaded(T)
+    case failed(Error)
+}
+```
+
+## Actor Pattern
+
+Use actors for shared mutable state instead of locks or dispatch queues:
+
+```swift
+actor Cache<Key: Hashable & Sendable, Value: Sendable> {
+    private var storage: [Key: Value] = [:]
+
+    func get(_ key: Key) -> Value? { storage[key] }
+    func set(_ key: Key, value: Value) { storage[key] = value }
+}
+```
+
+## Dependency Injection
+
+Inject protocols with default parameters — production uses defaults, tests inject mocks:
+
+```swift
+struct UserService {
+    private let repository: any UserRepository
+
+    init(repository: any UserRepository = DefaultUserRepository()) {
+        self.repository = repository
+    }
+}
+```
+
+## References
+
+See skill: `swift-actor-persistence` for actor-based persistence patterns.
+See skill: `swift-protocol-di-testing` for protocol-based DI and testing.

package/docs/rules/swift/security.md

@@ -0,0 +1,33 @@
+---
+paths:
+  - "**/*.swift"
+  - "**/Package.swift"
+---
+# Swift Security
+
+> This file extends [common/security.md](../common/security.md) with Swift specific content.
+
+## Secret Management
+
+- Use **Keychain Services** for sensitive data (tokens, passwords, keys) — never `UserDefaults`
+- Use environment variables or `.xcconfig` files for build-time secrets
+- Never hardcode secrets in source — decompilation tools extract them trivially
+
+```swift
+let apiKey = ProcessInfo.processInfo.environment["API_KEY"]
+guard let apiKey, !apiKey.isEmpty else {
+    fatalError("API_KEY not configured")
+}
+```
+
+## Transport Security
+
+- App Transport Security (ATS) is enforced by default — do not disable it
+- Use certificate pinning for critical endpoints
+- Validate all server certificates
+
+## Input Validation
+
+- Sanitize all user input before display to prevent injection
+- Use `URL(string:)` with validation rather than force-unwrapping
+- Validate data from external sources (APIs, deep links, pasteboard) before processing

package/docs/rules/swift/testing.md

@@ -0,0 +1,45 @@
+---
+paths:
+  - "**/*.swift"
+  - "**/Package.swift"
+---
+# Swift Testing
+
+> This file extends [common/testing.md](../common/testing.md) with Swift specific content.
+
+## Framework
+
+Use **Swift Testing** (`import Testing`) for new tests. Use `@Test` and `#expect`:
+
+```swift
+@Test("User creation validates email")
+func userCreationValidatesEmail() throws {
+    #expect(throws: ValidationError.invalidEmail) {
+        try User(email: "not-an-email")
+    }
+}
+```
+
+## Test Isolation
+
+Each test gets a fresh instance — set up in `init`, tear down in `deinit`. No shared mutable state between tests.
+
+## Parameterized Tests
+
+```swift
+@Test("Validates formats", arguments: ["json", "xml", "csv"])
+func validatesFormat(format: String) throws {
+    let parser = try Parser(format: format)
+    #expect(parser.isValid)
+}
+```
+
+## Coverage
+
+```bash
+swift test --enable-code-coverage
+```
+
+## Reference
+
+See skill: `swift-protocol-di-testing` for protocol-based dependency injection and mock patterns with Swift Testing.

package/docs/rules/testing.md

@@ -0,0 +1,77 @@
+# Testing Requirements
+
+## Minimum Coverage: 80%
+
+测试类型（**全部必需**）：
+
+1. **单元测试** — 单个函数、工具、组件
+2. **集成测试** — API 端点、数据库操作
+3. **E2E 测试** — 关键用户流程（按语言/栈选择框架）
+
+## TDD 工作流（强制）
+
+```
+1. 先写测试（RED）— 测试应当失败
+2. 跑测试 — 确认 FAIL
+3. 写最小实现（GREEN）— 测试通过
+4. 跑测试 — 确认 PASS
+5. 重构（IMPROVE）— 不破坏行为
+6. 验证覆盖率（≥ 80%）
+```
+
+## Agent 支持
+
+- **新功能 / bug 修复** → 派遣 `tdd-guide` 走 TDD 流程
+- **测试失败诊断** → `tdd-guide` 默认改实现不改测试
+- **E2E** → 独立派 `e2e-runner`（待补，Phase 2+）
+
+## 失败排查顺序
+
+1. 检查测试隔离（每个测试是否独立可跑）
+2. 验证 mock 是否正确
+3. 修实现，**不修测试**（除非测试本身的断言错误，且必须在报告中明说）
+
+## Test Structure (AAA Pattern)
+
+优先使用 Arrange-Act-Assert：
+
+```typescript
+test('计算余弦相似度', () => {
+  // Arrange
+  const v1 = [1, 0, 0]
+  const v2 = [0, 1, 0]
+
+  // Act
+  const sim = cosineSimilarity(v1, v2)
+
+  // Assert
+  expect(sim).toBe(0)
+})
+```
+
+## Test Naming
+
+用描述行为的中文/英文，不要堆栈技术词：
+
+```typescript
+test('查询无匹配市场时返回空数组', () => {})
+test('API key 缺失时抛出错误', () => {})
+test('Redis 不可用时降级到子串搜索', () => {})
+```
+
+## 完成前必跑
+
+- [ ] 所有相关测试通过
+- [ ] 覆盖率达标（项目目标，通常 80%+）
+- [ ] 行为变更同步更新或新增测试
+- [ ] 没有跳过的测试（`.skip` / `xit` / `pending`）—— 跳过等于隐藏 bug
+
+## 反模式
+
+| 反模式 | 为什么错 |
+|--------|---------|
+| 用 `@ts-ignore` / `as any` 掩盖测试失败 | 隐藏类型问题 |
+| 测试断言改成"通过"了事 | 抛弃了测试本身的价值 |
+| `expect(true).toBe(true)` 占位测试 | 浪费维护成本 |
+| 单个测试覆盖 5 个不相关行为 | 失败时定位困难 |
+| 测试有顺序依赖（test A 必须在 test B 前跑） | 隔离失败，CI 必爆 |